# Geting multiple IP address into geoip field (From,To)

**URL:** https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298
**Category:** Logstash
**Created:** [December 12, 2017, 10:21am UTC](https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298 "2017-12-12T10:21:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Ninoslav](https://avatars.discourse-cdn.com/v4/letter/n/edb3f5/32.png) [@Ninoslav](https://discuss.elastic.co/u/Ninoslav)
#### Post date: [December 12, 2017, 10:21am UTC](https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298/1 "2017-12-12T10:21:20Z")

</div>

Hello,

I`am having a situation, where i want to monitor Cisco routers, and i want to get both From and To IP address, into my geoIP field.

I havea line in my config file that looks something like  
geoip { source =\> "ClientIP" },

but that field can only hold data about one IP addres.

I was wondering is there a way to store info about 2 IP addresses, and how could i do it?

Thanks for the answers.

Cheers,

Ninoslav.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 12, 2017, 4:04pm UTC](https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298/2 "2017-12-12T16:04:06Z")

</div>

The geoip filter also has a `target` option that controls the destination field of the looked-up data (i.e. you need two geoip filters with different `source` and `target` values). Note that you'll have to update the index mappings (which is typically done with an index template) to actually turn the field stored in ES into a geo\_point field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2018, 4:04pm UTC](https://discuss.elastic.co/t/geting-multiple-ip-address-into-geoip-field-from-to/111298/3 "2018-01-09T16:04:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
